General
-
Target
14c6d942188587ff0f29679de43a2528_JaffaCakes118
-
Size
167KB
-
MD5
14c6d942188587ff0f29679de43a2528
-
SHA1
79c1f96ed01592c7e65c2e00f931a157c15f28e4
-
SHA256
7d4b5d1c4d2ac49cf030034937c48662bdb6bc3d765b2ae575d613a13c5ca46f
-
SHA512
cd457b1f340e1dd4d8d3167208f255d0b858f5b3d16f3743702ca2f7f4aa76595135bd3f7a1cc76178bf1f1489bc4b79392c922a7a89bba2aadfb450cdd5e8d5
-
SSDEEP
3072:XauB++hB+AYDt58T4Eu0RR61u/s9bLztDOCw9p+Wp+WIro:f7hG5y4Eug81Ss9bfsCw9dIr
Score
10/10
Malware Config
Extracted
Family
asyncrat
Botnet
Default
C2
109.248.201.153:6606
109.248.201.153:7707
109.248.201.153:8808
https://api.telegram.org/bot1838160324:AAGx7G67cqyw7VeKRQ5YefPIsnWGShXlcCE/sendMessage?chat_id=1842845625
Mutex
AsyncMutex_6SI8OkPnk
Attributes
-
delay
3
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
Async RAT payload 1 IoCs
-
Asyncrat family
-
StormKitty payload 1 IoCs
-
Stormkitty family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
14c6d942188587ff0f29679de43a2528_JaffaCakes118
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections